kravietz 🦇Jan 19

Ryan Chenkie:

Developers, please be careful when installing Homebrew. Google is serving sponsored links to a Homebrew site clone that has a cURL command to malware. The URL for this site is one letter different than the official site.

Note: Google allows the ad sponsors to specify an URL that will be displayed on the ad (original brew.sh here), but the click takes you to the malware domain brewe.sh.

#Apple #HomeBrew #Google #MacOS

Ryan Chenkie (@ryanchenkie) on X

⚠️ Developers, please be careful when installing Homebrew. Google is serving sponsored links to a Homebrew site clone that has a cURL command to malware. The URL for this site is one letter different than the official site.

X (formerly Twitter)
Show threadhardyjohnsonJan 19
@kravietz don’t worry Homebrew have conditioned everyone to just copy a curl pipe to shell command into their terminal, what could go wrong?
Show threadbazzarghJan 20

@hardyjohnson @kravietz this makes me wonder if there's a way to get curl to use an allow list for hosts; if I haven't put it in the list, it doesn't connect. would make me scrutinize anything that didn't work more.

I can't see an option directly, but I think a script wraapper that removed any proxy/noproxy options, added an unresolvable proxy (eg, notinallowlist.local), and then noproxied the allow-list would do it.

tested it, that works. Let's see how annoying this wrapper gets

Show threadSkullvalanche

@bazzargh @hardyjohnson @kravietz Piping to shell is _never_ safe.

https://web.archive.org/web/20250109045029/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

TLDR: it's possible for a malicious site to server-side detect if the script is being curl-piped-to-bash and serve up a different script than the one you think you're getting.

Detecting the use of "curl | bash" server side | Application Security

Another reason not to pipe from curl to bash. Detecting curl | bash serverside.

Jan 20 at 1:22amWeb
Show threadbazzarghJan 20
@skullvalanche @hardyjohnson @kravietz I know this. And I can't catch native code, or python, for example, downloading stuff. But bash+curl is low hanging fruit, a script that sneaks in a curl can be caught, so why not? we shouldn't just throw up our hands and say we'll be more careful in future when it's easy to prevent.